Where cyber attacks get in: the main entry points and what to check

Sorting attacks by entry point makes them easier to check

News of cyber attacks tends to centre on the organisations involved, but the ways attackers get into an organisation are limited. In the statistics of public bodies and research firms, the same routes keep appearing near the top: VPN devices and remote desktop exposed to the internet, stolen IDs and passwords, unpatched vulnerabilities, contractors and cloud services, and data taken out by insiders. This article does not discuss any specific incident. For each type of attack it sets out how it works, what the data says, and what to check.

The same routes run through the organisational list of Information Security 10 Major Threats 2026, published on 29 January 2026 by the Information-technology Promotion Agency, Japan (IPA). IPA selects candidate threats from the incidents and attacks of 2025, and a panel of about 250 members, including researchers and corporate practitioners, decides the ranking through deliberation and voting.

Ransomware: getting in through VPN devices and remote desktop

Ransomware is malicious software that encrypts the data on devices and servers so that it cannot be used, then demands money in exchange for decryption. Most cases now involve double extortion: the attackers steal the data first and threaten to publish it unless they are paid. The NPA describes the typical sequence as follows. Attackers get in by exploiting unpatched vulnerabilities or leaked credentials, try to seize administrator rights and disable security tools, search the network for important data and for backups, send data out, and only then encrypt.

According to the NPA’s report on the cyber threat situation in the first half of 2026 (September 2026), 123 ransomware cases were reported in that half-year, the most for any half-year since its statistics began in the second half of 2020. A further 9 cases of “no-ware ransom”, in which attackers steal data without encrypting it and demand payment, were also reported. The NPA says that most intrusions now come by remote operation through points exposed to the internet, and that infections through attachments to targeted emails have become less common. Over the whole of 2025, of 92 valid responses on the entry route, 61 named VPN devices, 19 remote desktop, and only 2 suspicious emails or their attachments. In the survey of victims in the first half of 2026, 60% of organisations spent 10 million yen or more in total on recovery, and fewer than half recovered within a month.

What to check

• An inventory of internet-facing devices: list your VPN devices, remote desktop services, firewalls and similar equipment, and record the model, firmware version, end-of-support date and owner. The Financial Services Agency’s (FSA) Guidelines on Cybersecurity for the Financial Sector also ask for hardware and software inventories, including network devices, that record support periods and version information.
• Multi-factor authentication for remote access: enforce multi-factor authentication on every VPN and remote access account, and leave no unused accounts or default passwords in place. The FSA guideline requires multi-factor authentication for remote access to critical systems.
• Backups that are isolated and restore-tested: keep backups in environments cut off from the internal network or in systems that cannot be altered, and test regularly that they can actually be restored. The FSA guideline asks institutions to build isolation and protection of backup data, integrity checks and recovery tests into their backup rules.
• Log collection and retention: keep logs from VPN devices, authentication systems and servers in a place where they cannot be tampered with, for as long as an investigation would need them. In the NPA survey, only 10 of 48 victims had preserved all their logs.

Stolen credentials and phishing

Phishing uses emails or text messages that pretend to come from a real organisation to lure people to a fake website, where they enter IDs, passwords, card numbers and the like. Stolen credentials are then also used to log in to VPNs and cloud services. Telephone-based methods are spreading too. According to the NPA, from autumn 2024 there was a sharp rise in fraudulent transfers from corporate accounts through “voice phishing”, in which criminals call a company, obtain an email address and then send a phishing email. In May 2026, damage rose sharply from a new method in which a phone call is used to get the company to install remote-control software, while a fake site captures its internet banking ID and password.

The Council of Anti-Phishing Japan received about 730,000 phishing reports in the first half of 2026 (as cited by the NPA), and 82,338 in August 2026 alone. By sector, August’s reports were about 43.3% e-commerce, about 29.0% credit card and consumer credit, and about 2.4% banking. The NPA notes that advances in AI have made the wording more natural and the impersonation more convincing, so phishing is getting harder to spot.

In Verizon’s 2026 Data Breach Investigations Report (DBIR), credential abuse accounted for 13% of initial access, losing the top place it had held to vulnerability exploitation. Even so, phishing accounted for 16% and pretexting, which builds trust through an invented scenario to get someone to act, for 6%, and the human element was involved in 62% of breaches. Microsoft’s Digital Defense Report 2025 says that more than 97% of identity attacks are password attacks, and that multi-factor authentication (MFA) can block over 99% of identity-based attacks. The NPA, for its part, says that technical measures such as email authentication and multi-factor authentication are not enough on their own.

What to check

• Coverage of multi-factor authentication: confirm from your inventory that every system reachable from outside, especially administrator accounts, VPNs, email and cloud services, has multi-factor authentication. The Council of Anti-Phishing Japan urges organisations to consider phishing-resistant multi-factor authentication such as passkeys.
• Email sender authentication: set up SPF, DKIM and DMARC so that receivers can recognise mail that impersonates your domain. The Council asks businesses that run online services to plan a move of their DMARC policy to reject (p=reject).
• A procedure for requests by phone or for remote access: if a caller claiming to be a business partner or a bank asks for an email address or credentials, or asks staff to install remote-control software, staff should not comply on the spot but call back on a known number. Set this procedure and make sure everyone knows it.
• A reporting route and training: give staff a place to report suspicious emails immediately, and in training measure the reporting rate as well as the click rate. The FSA guideline gives the reporting rate in targeted email training as an example of a key performance indicator (KPI).

Unpatched vulnerabilities, especially in edge devices

Devices that sit on the boundary between an organisation’s network and the internet, such as VPN devices and firewalls, can be reached from outside at any time. When a vulnerability is found in such a device, attackers scan the internet for affected units and try to get in before the fix is applied. The NPA’s sensors detected suspicious access, such as scanning for vulnerabilities, at a rate of 13,687 per IP address per day in the first half of 2026, up 50.7% year on year.

In Verizon’s 2026 DBIR, exploitation of vulnerabilities accounted for 31% of initial access and became the most common way in. Of the critical vulnerabilities listed in the Known Exploited Vulnerabilities (KEV) catalog of the US Cybersecurity and Infrastructure Security Agency (CISA), organisations fully remediated only 26% in 2025, down from 38% the year before, and the median time to full resolution rose to 43 days from 32. In financial services and insurance, too, exploitation of vulnerabilities is the leading initial access vector (22%), followed by phishing (20%) and credential abuse (15%). In the NPA’s survey for the first half of 2026, 17 of 29 ransomware victims that answered had unapplied security patches.

The KEV catalog is CISA’s list of vulnerabilities that have actually been exploited. A vulnerability is added when it meets three thresholds: it has a CVE ID, there is reliable evidence that it has been actively exploited in the wild, and there is a clear remediation action such as a vendor-provided update. CISA strongly recommends that all organisations review and monitor the KEV catalog and prioritise remediation of the listed vulnerabilities, and says organisations should use it as an input to their vulnerability management prioritisation framework.

CISA’s Binding Operational Directive BOD 26-04, issued on 10 June 2026 for US federal civilian executive branch agencies, sets remediation deadlines in calendar days according to whether a vulnerability is in the KEV catalog, whether the asset is publicly exposed, whether exploitation can be automated, and how much control an attacker would gain. The clock starts when the CVE is added to the KEV catalog or when the agency identifies the vulnerability on its own asset, whichever comes first. Where the directive also requires a forensic triage to check whether the asset has been compromised, the deadline is three days, while other cases may be fixed at the next scheduled major upgrade or rebuild. The directive does not apply to Japanese organisations, but the idea of setting deadlines by exposure and exploitation is a useful reference.

What to check

• Sources of vulnerability information: decide who checks the vendors of the products you use, information-sharing bodies such as JPCERT/CC, and the KEV catalog, and how often, and match what they find against your inventory so that affected devices can be identified at once.
• Deadlines by severity and exposure: set patch deadlines for each category, for example putting actively exploited vulnerabilities in internet-facing devices first, and record the share of patches applied on time.
• Approved exceptions and compensating controls: where a patch cannot be applied quickly, record the management approval, the compensating control (disabling a feature, restricting where connections may come from) and the date for reassessment. Devices past end of support no longer receive fixes, so plan their replacement from the end-of-support dates in your inventory. CISA has also issued a directive on mitigating risk from end-of-support edge devices (BOD 26-02).
• Checking for compromise after patching: an exploited vulnerability may have been used before you patched it. Alongside the fix, check the logs for unfamiliar accounts or configuration changes.

Contractors, the supply chain and cloud services

Even with strong defences of your own, your data and operations are harmed if a contractor that builds or maintains your systems, a cloud service holding your data, or a SaaS product you use is breached. Remote maintenance connections and contractors’ accounts can also become a way into your own network.

In IPA’s 10 Major Threats 2026, attacks targeting supply chains and outsourcees rank second on the organisational list and have been selected eight years in a row. In Verizon’s 2026 DBIR, breaches with third-party involvement rose 60% from the previous year to 48% of all breaches (34% in financial services and insurance). The report also found that only 23% of third-party organisations fully remediated missing or improperly secured multi-factor authentication on their cloud accounts, and that for weak passwords and permission misconfigurations it took almost eight months for half of the findings to be resolved.

In the PPC’s annual report for fiscal 2025, of the 13,345 breach reports made directly to the Commission, 1,292 (9.7%) occurred at a contractor. Among breaches caused by unauthorised access, 533 occurred at the reporting business itself and 328 at a contractor. The FSA guideline notes that cyber incidents originating in the supply chain have caused significant harm to financial institutions. Its fundamental response measures for third-party risk management include a register of third parties, due diligence before starting a relationship, requirements written into contracts and SLAs, continuous monitoring, and controls at the end of the relationship, and it asks institutions to decide which third parties to cover on a risk basis.

What to check

• A supplier register: for each contractor and cloud provider, record the products, services and functions it provides, its level of access to your systems, and the types, sensitivity and location of your data that it holds or processes (the example items in the FSA guideline). Include SaaS contracted by individual departments.
• What the contract says: according to importance, write into contracts or SLAs the division of roles and responsibilities, audit rights, subcontracting procedures, incident response and reporting, response to and reporting of serious vulnerabilities, data location and disposal, and arrangements at the end of the contract.
• Connections from suppliers: list remote maintenance connections and supplier accounts, and confirm multi-factor authentication, limits on when and where they can connect, and removal of connections no longer used.
• Cloud settings: regularly review multi-factor authentication on administrator accounts, external publishing and sharing settings, and permission assignments. Third-party assurance reports (such as SOC 2) and third-party certifications can be used as evidence.

Insiders and excessive privileges

Insider wrongdoing is when an employee or a contractor’s staff member with legitimate access takes information out or misuses it. Accounts left open after people leave, and permissions wider than the job needs, make insider wrongdoing easier and also widen the damage when an outside attacker takes over an account. As noted above, ransomware attackers also try to seize administrator rights once inside.

In IPA’s 10 Major Threats 2026, information leaks and other harm caused by insiders rank seventh on the organisational list and have been selected 11 years in a row. In Verizon’s 2026 DBIR, internal actors were involved in 12% of breaches in financial services and insurance. In the PPC’s annual report for fiscal 2025, breaches caused by insider wrongdoing numbered 75 at the reporting businesses themselves and 7 at contractors, far fewer than those caused by handing documents to the wrong person (6,072 at the reporting businesses) or sending them to the wrong address (2,889). Managing permissions and procedures reduces both wrongdoing and mistakes. The FSA guideline lists points such as the following among its fundamental measures for authentication and access management.

What to check

• Least privilege and segregation of duties: limit access rights to the minimum each job requires, and do not let the same person request, approve and carry out an action.
• Regular access reviews: manage accounts from creation to deletion, and regularly review the accounts and permissions of people who have moved roles or left. Include access rights used by contractors.
• Privileged account management: strictly limit the use of administrator rights, with multi-factor authentication, double checks on operations and time limits on use.
• Reviewing activity logs: log activity so that you can tell who did what, and check system event logs and operators’ work logs regularly or whenever needed.

Incident response plans and exercises

No organisation can stop every intrusion, so deciding in advance what to do after one is also part of the checks. The FSA guideline asks institutions to prepare incident response plans and contingency plans, including recovery plans, for each type of cyber attack, setting response priorities, recovery time objectives and recovery level objectives. It also asks them to test the plans through regular exercises and training, to have senior management, the CISO or equivalent, and business line heads take part and understand the results, and to consider involving outsourcees where needed. The NPA likewise urges organisations to draw up business continuity plans (BCPs) that assume a cyber attack and to contact the police promptly when damage occurs.

• Procedures by attack type: for ransomware, data leaks through unauthorised access, DDoS attacks and other types, set out the first response, containment, recovery and communication steps.
• Contacts and roles: keep the contact details and roles of senior management, IT, public relations, legal and contractor staff in a form you can still reach if internal systems are down.
• Decisions on reporting and disclosure: decide who decides, and when, on contacting the police, reporting to the supervisory authority, reporting to the PPC, and informing customers and the public.
• Exercises: run tabletop exercises on realistic scenarios with serious impact on customers, and feed the issues they reveal into revisions of the plan.

Reporting duties when personal data leaks

Under Japan’s amended Act on the Protection of Personal Information, fully in force since 1 April 2022, a business must report to the PPC and, unless that is difficult, notify the individuals concerned when a leak or other breach of personal data, or the risk of one, falls into one of the situations below. In fiscal 2025 (April 2025 to March 2026) the PPC handled 17,139 reports from businesses, down from 19,056 the year before. By category, 61.9% involved special care-required personal information and 22.3% involved acts that may have been carried out for a wrongful purpose. In 93.6% of cases 1,000 people or fewer were affected; 121 cases (0.7%) involved more than 50,000 people.

Reporting comes in two stages. The PPC asks for a preliminary report within three to five days of discovery and a final report within 30 days, or within 60 days where the breach may have been carried out for a wrongful purpose. Since 1 October 2025, breaches caused by ransomware can also be reported on a common form. The amended Act promulgated on 17 July 2026 will ease the duty to notify individuals where there is little risk to their rights and interests. It is to take effect, in principle, within two years of promulgation, and until then the current duties apply.

What to check

• A decision procedure: write down who decides whether a suspected breach must be reported, and how the preliminary report will be made within three to five days.
• Notice from contractors: so that you hear quickly when a breach happens at a contractor, set the duty to report, the deadline and the contact point in the contract.
• Templates: prepare templates for the items in the report to the PPC, the notice to individuals and the details of the enquiry desk.
• For financial institutions: the FSA guideline asks institutions to report incidents promptly to the regulators in line with laws and regulations. Organise the contact points and owners so that this can run in parallel with the report to the PPC.

Governance that keeps the checks going

None of the checks above is done once and finished. Unless each has an owner, its deadlines are tracked and records of the work are kept, you cannot show what was done when an audit or an incident comes. The FSA guideline asks senior management to require reports on cybersecurity key performance indicators (KPIs) and key risk indicators (KRIs) at least twice a year, giving as examples of KPIs the vulnerability response rate and the progress of information asset inventories, and as examples of KRIs the number of unaddressed vulnerabilities and the number of incidents. Policies and business processes are to be reviewed at least once a year.

1. Assign owners: name an accountable owner and a person who does the work for each check, covering device inventories, patching, backups, suppliers, access reviews and exercises.
2. Track deadlines: keep patch deadlines, access review cycles and the dates of restore tests and exercises in one list, and include overdue items in reports to senior management.
3. Keep evidence: retain inventory change histories, review results, records of restore tests and exercises, and records of approved exceptions, ready to show in audits and in response to enquiries from regulators and clients.
4. Revisit exceptions: give every exception, such as a deferred patch or a permission left in place, an expiry date, and reassess it when that date comes.
5. Turn results into indicators: report regularly on figures such as multi-factor authentication coverage, the share of patches applied on time and the success rate of restore tests, and confirm that they improve.